The npm package @years17/n8n-nodes-utils-helper-i version 1.0.0 contains malicious code that grants persistent SSH access to the host by appending an attacker-controlled SSH public key to multiple user authorized_keys files. It also performs host reconnaissance and exfiltrates data via an unverified HTTPS request. The malicious behavior triggers both during post-install and when the package is required, bypassing common script-ignore flags.